Executive takeaway: Most AI tools are not meeting data sovereignty requirements because they are processing the data outside of Australia. It’s important for NFPs to fully evaluate every AI capability they are considering to understand this risk.
If you are a Not for Profit with data sovereignty requirements, beware of where AI tools process your information.
I have been reviewing AI tools on behalf of several charity clients and am increasingly finding statements about data being stored in Australia. However, after looking harder, I can see that it’s being processed in another country – potentially breaching government contract obligations.
This has even happened in Allied Health note-taking tools that I have reviewed.
If you are unsure, ask the vendor specifically these questions:
1) Where is our data stored (not just documents)?
2) Where is our data processed when the AI feature is used?
3) What data is sent to the AI model, including prompts, documents, audio, transcripts, prior records, notes, metadata, logs, or search results?
4) What 3rd-party subprocessors are you using to deliver any part of the services? What do they do, and where are they located?
5) What are the retention periods for our data, prompts, transcripts, outputs, logs and backups? And can offshore support staff access any of it?
Unfortunately, there are not many vendors that meet this requirement. Even Microsoft Copilot is NOT hosting their AI processing in Australia yet – scheduled for end of 2026.
So beware how you should fully consider your use of AI tools with this kind of data until you can verify “local inference” with your vendors.
Feel free to send me a message if this all sounds too confusing. And if you have found similar concerns, I’d love to know more.
I regularly help Not for Profits review their AI tools. If you want a second opinion, let me know.
P.S. If you found this article helpful, you might want to read these too:
Tammy Ven Dange is a former charity CEO, Association President, Not for Profit Board Member and IT Executive. Today, she helps NFPs with strategic IT decisions, especially around major investments and risk mitigation.
